{"total":536,"rows":[{"id":"2412.16720","title":"OpenAI o1 System Card","created":"2024-12-21","cited_by_count":1244,"area":"lr"},{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2410.09024","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","created":"2024-10-11","cited_by_count":437,"area":"agents"},{"id":"2412.16339","title":"Deliberative Alignment: Reasoning Enables Safer Language Models","created":"2024-12-20","cited_by_count":308,"area":"lr"},{"id":"2406.14598","title":"SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal","created":"2024-06-20","cited_by_count":240,"area":"alignment"},{"id":"2408.15221","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","created":"2024-08-27","cited_by_count":151,"area":"safety"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2504.13203","title":"X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents","created":"2025-04-15","cited_by_count":125,"area":"agents"},{"id":"2407.18418","title":"Know Your Limits: A Survey of Abstention in Large Language Models","created":"2024-07-25","cited_by_count":121,"area":null},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2502.17420","title":"The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence","created":"2025-02-24","cited_by_count":115,"area":"alignment"},{"id":"2506.14866","title":"OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents","created":"2025-06-17","cited_by_count":111,"area":"agents"},{"id":"2507.11878","title":"LLMs Encode Harmfulness and Refusal Separately","created":"2025-07-16","cited_by_count":88,"area":"safety"},{"id":"2407.04069","title":"A Systematic Survey and Critical Review on Evaluating Large Language Models: Challenges, Limitations, and Recommendations","created":"2024-07-04","cited_by_count":85,"area":null},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2407.11969","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","created":"2024-07-16","cited_by_count":79,"area":"safety"},{"id":"2407.17436","title":"AIR-Bench 2024: A Safety Benchmark Based on Risk Categories from Regulations and Policies","created":"2024-07-11","cited_by_count":74,"area":null},{"id":"2406.00799","title":"Get my drift? Catching LLM Task Drift with Activation Deltas","created":"2024-06-02","cited_by_count":72,"area":"rag"},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72,"area":"safety"},{"id":"2406.01288","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","created":"2024-06-03","cited_by_count":70,"area":"safety"},{"id":"2504.01903","title":"STAR-1: Safer Alignment of Reasoning LLMs with 1K Data","created":"2025-04-02","cited_by_count":68,"area":"lr"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2406.05498","title":"SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner","created":"2024-06-08","cited_by_count":63,"area":"safety"},{"id":"2505.08054","title":"FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning","created":"2025-05-12","cited_by_count":58,"area":"lr"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2506.07022","title":"AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint","created":"2025-06-08","cited_by_count":49,"area":"safety"},{"id":"2410.03415","title":"Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablation","created":"2024-10-04","cited_by_count":48,"area":null},{"id":"2410.13722","title":"Persistent Pre-Training Poisoning of LLMs","created":"2024-10-17","cited_by_count":48,"area":null},{"id":"2411.16721","title":"Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks","created":"2024-11-23","cited_by_count":48,"area":"mllm"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2601.11516","title":"Building Production-Ready Probes For Gemini","created":"2026-01-16","cited_by_count":47,"area":"safety"},{"id":"2405.17374","title":"Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models","created":"2024-05-27","cited_by_count":46,"area":"alignment"},{"id":"2410.01606","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","created":"2024-10-02","cited_by_count":45,"area":"agents"},{"id":"2411.18688","title":"Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment","created":"2024-11-27","cited_by_count":44,"area":"lr"},{"id":"2503.15754","title":"AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration","created":"2025-03-20","cited_by_count":43,"area":"safety"},{"id":"2504.16980","title":"Safety Pretraining: Toward the Next Generation of Safe AI","created":"2025-04-23","cited_by_count":43,"area":null},{"id":"2405.20413","title":"Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters","created":"2024-05-30","cited_by_count":42,"area":"safety"},{"id":"2410.04350","title":"TIS-DPO: Token-level Importance Sampling for Direct Preference Optimization With Estimated Weights","created":"2024-10-06","cited_by_count":42,"area":"alignment"},{"id":"2405.20099","title":"Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks","created":"2024-05-30","cited_by_count":37,"area":"safety"},{"id":"2406.09289","title":"Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models","created":"2024-06-13","cited_by_count":37,"area":"safety"},{"id":"2406.17864","title":"AI Risk Categorization Decoded (AIR 2024): From Government Regulations to Corporate Policies","created":"2024-06-25","cited_by_count":37,"area":null},{"id":"2503.07885","title":"Safety Guardrails for LLM-Enabled Robots","created":"2025-03-10","cited_by_count":35,"area":"safety"},{"id":"2410.15236","title":"Jailbreaking and Mitigation of Vulnerabilities in Large Language Models","created":"2024-10-20","cited_by_count":34,"area":"safety"},{"id":"2507.11097","title":"The Devil behind the mask: An emergent safety vulnerability of Diffusion LLMs","created":"2025-07-15","cited_by_count":34,"area":"inference"},{"id":"2506.03350","title":"Adversarial Attacks on Robotic Vision Language Action Models","created":"2025-06-03","cited_by_count":32,"area":"vla"},{"id":"2406.09321","title":"JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models","created":"2024-06-13","cited_by_count":31,"area":"safety"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2502.06872","title":"Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey","created":"2025-02-08","cited_by_count":30,"area":"rag"},{"id":"2405.16229","title":"No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks","created":"2024-05-25","cited_by_count":29,"area":"alignment"},{"id":"2502.01633","title":"Adversarial Reasoning at Jailbreaking Time","created":"2025-02-03","cited_by_count":29,"area":"lr"},{"id":"2505.18807","title":"Mitigating Deceptive Alignment via Self-Monitoring","created":"2025-05-24","cited_by_count":29,"area":"lr"},{"id":"2405.20653","title":"Mind the Inconspicuous: Revealing the Hidden Weakness in Aligned LLMs' Refusal Boundaries","created":"2024-05-31","cited_by_count":28,"area":"alignment"},{"id":"2504.10694","title":"The Jailbreak Tax: How Useful are Your Jailbreak Outputs?","created":"2025-04-14","cited_by_count":28,"area":"safety"},{"id":"2505.11842","title":"Video-SafetyBench: A Benchmark for Safety Evaluation of Video LVLMs","created":"2025-05-17","cited_by_count":28,"area":"mllm"},{"id":"2510.12252","title":"PromptLocate: Localizing Prompt Injection Attacks","created":"2025-10-14","cited_by_count":28,"area":"safety"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2406.06622","title":"Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs","created":"2024-06-07","cited_by_count":26,"area":"safety"},{"id":"2506.11094","title":"The Scales of Justitia: A Comprehensive Survey on Safety Evaluation of LLMs","created":"2025-06-06","cited_by_count":26,"area":null},{"id":"2410.15362","title":"Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Models","created":"2024-10-20","cited_by_count":25,"area":"alignment"},{"id":"2503.11751","title":"reWordBench: Benchmarking and Improving the Robustness of Reward Models with Transformed Inputs","created":"2025-03-14","cited_by_count":25,"area":"alignment"},{"id":"2408.04811","title":"h4rm3l: A language for Composable Jailbreak Attack Synthesis","created":"2024-08-09","cited_by_count":24,"area":"safety"},{"id":"2503.04474","title":"Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges","created":"2025-03-06","cited_by_count":24,"area":"safety"},{"id":"2410.02298","title":"Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models","created":"2024-10-03","cited_by_count":23,"area":"safety"},{"id":"2410.10414","title":"On Calibration of LLM-based Guard Models for Reliable Content Moderation","created":"2024-10-14","cited_by_count":23,"area":"safety"},{"id":"2503.08669","title":"SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints","created":"2025-03-11","cited_by_count":23,"area":"agents"},{"id":"2405.17814","title":"FAIntbench: A Holistic and Precise Benchmark for Bias Evaluation in Text-to-Image Models","created":"2024-05-28","cited_by_count":22,"area":null},{"id":"2502.03052","title":"Understanding and Enhancing the Transferability of Jailbreaking Attacks","created":"2025-02-05","cited_by_count":22,"area":"safety"},{"id":"2511.20703","title":"PropensityBench: Evaluating Latent Safety Risks in Large Language Models via an Agentic Approach","created":"2025-11-24","cited_by_count":22,"area":"agents"},{"id":"2410.03523","title":"A Probabilistic Perspective on Unlearning and Alignment for Large Language Models","created":"2024-10-04","cited_by_count":21,"area":"alignment"},{"id":"2410.19937","title":"RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction","created":"2024-10-25","cited_by_count":21,"area":"safety"},{"id":"2411.08410","title":"The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense","created":"2024-11-13","cited_by_count":21,"area":"safety"},{"id":"2505.15406","title":"Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Models","created":"2025-05-21","cited_by_count":21,"area":"safety"},{"id":"2506.10597","title":"SoK: Evaluating Jailbreak Guardrails for Large Language Models","created":"2025-06-12","cited_by_count":21,"area":"alignment"},{"id":"2509.22067","title":"The Rogue Scalpel: Activation Steering Compromises LLM Safety","created":"2025-09-26","cited_by_count":21,"area":"safety"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2503.00187","title":"Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks","created":"2025-02-28","cited_by_count":20,"area":"safety"},{"id":"2505.16186","title":"SafeKey: Amplifying Aha-Moment Insights for Safety Reasoning","created":"2025-05-22","cited_by_count":20,"area":"lr"},{"id":"2509.21834","title":"RobustFlow: Towards Robust Agentic Workflow Generation","created":"2025-09-26","cited_by_count":20,"area":"agents"},{"id":"2410.01524","title":"HarmAug: Effective Data Augmentation for Knowledge Distillation of Safety Guard Models","created":"2024-10-02","cited_by_count":19,"area":"distill"},{"id":"2506.07596","title":"TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts","created":"2025-06-09","cited_by_count":19,"area":"safety"},{"id":"2405.13068","title":"Uncovering Logit Suppression Vulnerabilities in LLM Safety Alignment","created":"2024-05-20","cited_by_count":18,"area":"alignment"},{"id":"2503.02574","title":"LLM-Safety Evaluations Lack Robustness","created":"2025-03-04","cited_by_count":18,"area":"alignment"},{"id":"2507.19060","title":"PurpCode: Reasoning for Safer Code Generation","created":"2025-07-25","cited_by_count":18,"area":"lr"},{"id":"2501.10573","title":"The Intrinsic Dimension of Prompts in Internal Representations of Large Language Models","created":"2025-01-17","cited_by_count":17,"area":"mechinterp"},{"id":"2508.07646","title":"Multi-Turn Jailbreaks Are Simpler Than They Seem","created":"2025-08-11","cited_by_count":17,"area":"safety"},{"id":"2510.21189","title":"Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency","created":"2025-10-24","cited_by_count":17,"area":"safety"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2505.13527","title":"Logic Jailbreak: Efficiently Unlocking LLM Safety Restrictions Through Formal Logical Expression","created":"2025-05-18","cited_by_count":16,"area":"alignment"},{"id":"2505.15710","title":"Advancing LLM Safe Alignment with Safety Representation Ranking","created":"2025-05-21","cited_by_count":16,"area":"safety"},{"id":"2505.17568","title":"JALMBench: Benchmarking Jailbreak Vulnerabilities in Audio Language Models","created":"2025-05-23","cited_by_count":16,"area":"safety"},{"id":"2505.20087","title":"Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Models","created":"2025-05-26","cited_by_count":16,"area":"lr"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2412.03235","title":"Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts?","created":"2024-12-04","cited_by_count":15,"area":"safety"},{"id":"2502.02260","title":"Position: Adversarial ML for LLMs Is Not Making Any Progress","created":"2025-02-04","cited_by_count":15,"area":null},{"id":"2502.04322","title":"Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions","created":"2025-02-06","cited_by_count":15,"area":"alignment"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2506.05739","title":"To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt","created":"2025-06-06","cited_by_count":15,"area":"agents"},{"id":"2509.24384","title":"HarmMetric Eval: Benchmarking Metrics and Judges for LLM Harmfulness Assessment","created":"2025-09-29","cited_by_count":15,"area":"safety"}],"next_cursor":"100"}